@xuda.io/account_module 1.2.1871 → 1.2.1872

package/index.mjs

@@ -3455,36 +3455,26 @@ function isLikelySpamEmail(email) {
 
   if (!localPart || !domain) return true;
 
-  // 1. Obvious syntax/format red flags (RFC 5321/5322 inspired)
-  if (
-    localPart.length > 64 ||
-    domain.length > 255 ||
-    localPart.startsWith('.') ||
-    localPart.endsWith('.') ||
-    localPart.includes('..') ||
-    domain.includes('..') ||
-    domain.startsWith('-') ||
-    domain.endsWith('-') ||
-    /[^\w.!#$%&'*+/=?^`{|}~-]/.test(localPart) // illegal chars
-  ) {
+  // 1. Obvious syntax/format red flags (unchanged — strict is good here)
+  if (localPart.length > 64 || domain.length > 255 || localPart.startsWith('.') || localPart.endsWith('.') || localPart.includes('..') || domain.includes('..') || domain.startsWith('-') || domain.endsWith('-') || /[^\w.!#$%&'*+/=?^`{|}~-]/.test(localPart)) {
     return true;
   }
 
-  // 2. Common spam patterns in local part
+  // 2. Common spam patterns (unchanged — these are strong signals)
   const spamPatterns = [
     /\d{8,}/, // long consecutive digits
-    /[a-z]{20,}/, // very long random lowercase (raised threshold)
+    /[a-z]{20,}/, // very long random lowercase
     /unsubscribe/i,
     /free|win|bonus|deal|promo/i,
-    /\+\d+$/, // + followed only by digits
-    /^[\d\W_]+$/, // only digits/symbols/underscores
+    /\+\d+$/,
+    /^[\d\W_]+$/,
   ];
 
   if (spamPatterns.some((p) => p.test(localPart))) {
     return true;
   }
 
-  // 3. Free / major disposable providers
+  // 3. Free / major disposable providers — RELAXED
   const freeOrDisposableDomains = new Set([
     'gmail.com',
     'yahoo.com',
@@ -3513,44 +3503,76 @@ function isLikelySpamEmail(email) {
     'mailinator.com',
     'yopmail.com',
     'sharklasers.com',
-    // For real disposables: load dynamically from https://raw.githubusercontent.com/disposable/disposable/master/domains.txt
-    // or https://raw.githubusercontent.com/disposable-email-domains/disposable-email-domains/main/disposable_email_blocklist.conf
-    // Example: fetch once on startup and build a larger Set
+    // Consider dynamic loading for real disposables (see comment above)
   ]);
 
   if (freeOrDisposableDomains.has(domain)) {
-    const cleanLocal = localPart.split('+')[0]; // ignore +tag completely
+    const cleanLocal = localPart.split('+')[0].toLowerCase(); // ignore +tag
+
+    // Expanded serious/role keywords
+    const roleKeywords = ['info', 'support', 'sales', 'contact', 'hello', 'team', 'admin', 'office', 'billing', 'help', 'service', 'orders', 'bookings', 'quotes', 'enquiries', 'noreply', 'no-reply'];
+
+    // New: business/service descriptive keywords (very common for small trades on Gmail)
+    const businessKeywords = [
+      'locksmith',
+      'doors',
+      'garage',
+      'repair',
+      'pro',
+      'expert',
+      '247',
+      '24hr',
+      'emergency',
+      'mobile',
+      'auto',
+      'key',
+      'security',
+      'home',
+      'commercial',
+      'residential',
+      'plumbing',
+      'electric',
+      'hvac',
+      'cleaning',
+      'pest',
+      'movers',
+      'towing',
+      'tutor',
+      // Add more relevant to your audience/use-case
+    ];
 
-    const seriousPrefixes = ['info', 'support', 'sales', 'contact', 'hello', 'team', 'admin', 'office', 'billing', 'help', 'service', 'orders', 'bookings', 'quotes', 'enquiries', 'noreply', 'no-reply', 'business', 'shop', 'store'];
+    const allKeywords = [...roleKeywords, ...businessKeywords];
 
-    // Better detection: any segment contains a serious keyword
+    // Check if any segment contains a keyword
     const parts = cleanLocal.split(/[\.-]/);
-    const looksLikeRoleOrBrand = seriousPrefixes.some((p) => parts.some((part) => part.includes(p)));
+    const looksTrusted = allKeywords.some((kw) => parts.some((part) => part.includes(kw)) || cleanLocal.includes(kw));
 
-    if (looksLikeRoleOrBrand) {
-      return false; // trusted-looking on free provider
+    if (looksTrusted) {
+      return false; // early pass for role or descriptive business names
     }
 
-    // Extra scrutiny if not role-like
-    if (cleanLocal.length > 24 || /\d{6,}/.test(cleanLocal)) {
+    // Relaxed extra scrutiny
+    if (cleanLocal.length > 32 || /\d{8,}/.test(cleanLocal)) {
+      // ← raised thresholds
       return true;
     }
 
-    return false; // default: allow typical personal use on Gmail etc.
+    return false; // default: allow most personal / semi-descriptive Gmail use
   }
 
-  // 4. Very short / meaningless / bot-like local parts
-  if (localPart.length < 2 || /^[a-z\d]{1,5}$/.test(localPart)) {
-    return true; // e.g. a1@, xyz12@, but allow real short like "tim@"
+  // 4. Very short / meaningless / bot-like — SLIGHTLY relaxed
+  if (localPart.length < 2 || /^[a-z\d]{1,6}$/.test(localPart)) {
+    // ← up to 6 chars
+    return true;
   }
 
-  // 5. Suspicious new/low-trust TLDs (still relevant in 2026)
+  // 5. Suspicious TLDs (unchanged — still useful)
   const suspiciousTlds = ['.top', '.xyz', '.club', '.online', '.site', '.fun', '.buzz', '.shop', '.store', '.live', '.digital', '.monster'];
   if (suspiciousTlds.some((tld) => domain.endsWith(tld))) {
     return true;
   }
 
-  // Extra: very long local parts are rare for humans
+  // Extra: very long local parts (unchanged)
   if (localPart.length > 40) {
     return true;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/account_module",
-  "version": "1.2.1871",
+  "version": "1.2.1872",
   "description": "Xuda Account Server Module",
   "main": "index.mjs",
   "dependencies": {